Eclipse Jetty host filter is case-sensitive for DNS hostnames
Priority HIGH 77CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Partial Red Hat: 16 fixed, 13 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Eclipse Jetty jetty-server 12.0.0 through 12.0.38 and 12.1.0 through 12.1.11, and jetty-proxy 9.0.0 through 9.4.64, 10.0.0 through 10.0.32 and 11.0.0 through 11.0.32, compare host names in the whitelist and blacklist case-sensitively (CWE-178). Because DNS hostnames are case-insensitive, hosts that differ only by case pass a filter meant to block them. An unauthenticated remote attacker can use this to reach hosts the filter should exclude.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Partial Red Hat: 15 advisoriesRed Hat: 16 fixed, 13 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | org.eclipse.jetty:jetty-server | 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 | — | No fix listed | CNA |
| Eclipse Foundation | org.eclipse.jetty:jetty-proxy | 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.0.0 – 9.4.64 | — | No fix listed | CNA |
- org.eclipse.jetty:jetty-server VendorEclipse Foundation Affected 12.1.0 – 12.1.11; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-proxy VendorEclipse Foundation Affected 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.0.0 – 9.4.64 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for org.eclipse.jetty:jetty-server or org.eclipse.jetty:jetty-proxy. Red Hat fixes this in Satellite 6.16 EUS (RHSA-2026:92858), 6.17 (RHSA-2026:92859) and 6.18 (RHSA-2026:92860), and in OpenShift Jenkins 4.12 (RHSA-2026:88152), 4.13 (RHSA-2026:88149), 4.14 (RHSA-2026:88151), 4.15 (RHSA-2026:88150), 4.16 (RHSA-2026:88156), 4.17 (RHSA-2026:88159), 4.18 (RHSA-2026:88153), 4.19 (RHSA-2026:88158), 4.20 (RHSA-2026:88157), 4.21 (RHSA-2026:88155) and 4.22 (RHSA-2026:88154).
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Red Hat 15 advisories
- RHSA-2026:92859 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.17 security update
- Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:92861 Released 2026-10-29 · Red Hat rating CriticalSatellite 6.19 security update
- Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
- RHSA-2026:92858 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.16 EUS security update
- Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
- Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
Show 12 more Red Hat advisories
- RHSA-2026:92860 Released 2026-10-29 · Red Hat rating ImportantSatellite 6.18 security update
- Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
- RHSA-2026:88159 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88158 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88157 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88156 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88155 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88154 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88153 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88151 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88152 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88149 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88150 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| OpenShift Developer Tools and Services | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:88152 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:88149 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:88151 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:88150 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:88156 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:88159 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:88153 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:88158 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:88157 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:88155 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:88154 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:92858 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:92858 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:92859 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:92860 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:92861 |
Not affected: 22 products
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-16 Threatist record created from CVE-2026-18660
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-16 CVSS score added · Red Hat
- 2026-10-19 Affected versions changed · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
- 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +1 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.19 for RHEL 9 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
References
More Eclipse Foundation vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
- TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
- TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
- TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
- TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-18660 · CVE Program
- CVE-2026-18660 · NVD
- FIRST EPSS
- CVE-2026-18660 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences